RDS cluster uses a non-default port for its database engine

Check ID: rds_cluster_non_default_port
Provider: AWS
Service: rds
Severity: LOW
Resource type: AwsRdsDbCluster

What this check verifies

RDS DB clusters are assessed for use of a non-default database port. Evaluation focuses on whether the cluster listens on the engine’s well-known default port (e.g., 3306, 5432, 1433, 1521, 50000) or on a custom port.

Risk

Using a default DB port eases discovery via mass scans and banner-grabbing, enabling:

Engine-specific exploit attempts
Brute-force/credential-stuffing of logins
Targeted DDoS on the service

Impacts: confidentiality (unauthorized reads), integrity (data changes), availability (service disruption).

Recommendation

Use a non-default port and enforce least-privilege network access:

Allow only approved sources
Keep databases in private subnets
Require TLS and strong, centralized auth
Monitor failed connections

Update application connection strings to the new port as part of defense-in-depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws rds modify-db-cluster —db-cluster-identifier <db-cluster-id> —port <non-default-port> —apply-immediately

# Terraform: Set a non-default port on an RDS/Aurora DB cluster
resource "aws_rds_cluster" "<example_resource_name>" {
  engine          = "<engine>"
  master_username = "<username>"
  master_password = "<password>"
  port            = <non-default-port> # Critical: use a non-default engine port to pass the check
}

# CloudFormation: Set a non-default port on an RDS/Aurora DB cluster
Resources:
  <example_resource_name>:
    Type: AWS::RDS::DBCluster
    Properties:
      Engine: <engine>
      MasterUsername: <username>
      MasterUserPassword: <password>
      Port: <non-default-port>  # Critical: change to a non-default engine port to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = rds_cluster_non_default_port. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

RDS cluster has Multi-AZ enabled RDS cluster is protected by an AWS Backup plan

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires